fix(infrastructure): delete application db PVC on instance teardown (#356)

The application template's Postgres StatefulSet left its data PVC behind when
an Application was deleted, so recreating with the same name failed with
"password authentication failed for user appuser": the pwgen Job minted a
fresh password into the new credentials Secret while Postgres recovered the
orphaned volume (old password).

The PVC is created by the StatefulSet controller from volumeClaimTemplates,
not by kro, so it has no kro labels and isn't in kro's applyset — kro never
GCs it. And the StatefulSet's default persistentVolumeClaimRetentionPolicy
(whenDeleted: Retain) keeps it across a StatefulSet delete. So nothing cleaned
it up.

Set whenDeleted: Delete so the PVC's lifecycle follows the StatefulSet kro
deletes on teardown; a same-name recreate then starts from a fresh database.
whenScaled stays Retain (no horizontal scaling here anyway).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: mjudeikis

providers/infrastructure/install/templates/application.yaml

@@ -311,6 +311,18 @@ spec:
           spec:
             serviceName: ${schema.spec.name}-db
             replicas: 1
+            # Tie the data PVC's lifecycle to the StatefulSet. The PVC is
+            # created by the StatefulSet controller from volumeClaimTemplates
+            # (NOT by kro), so it carries no kro labels and isn't in kro's
+            # applyset — kro never garbage-collects it. With the k8s default
+            # (whenDeleted: Retain) the PVC also outlives a StatefulSet delete,
+            # so deleting an Application orphaned the volume: a same-name
+            # recreate minted a fresh db password but Postgres recovered the old
+            # data (old password) → "password authentication failed". Delete the
+            # PVC when kro deletes the StatefulSet so a recreate starts clean.
+            persistentVolumeClaimRetentionPolicy:
+              whenDeleted: Delete
+              whenScaled: Retain
             selector:
               matchLabels:
                 app: ${schema.spec.name}-db